This message was deleted.
# generala
adamant-kite-43734
10/30/2023, 2:16 PMThis message was deleted.
g
great-jewelry-76121
10/30/2023, 2:16 PMThere's an order of precedence. If you want to use the value in FelixConfig, you have to have NOT set the associated env var on the calico-node pod
great-jewelry-76121
10/30/2023, 2:17 PMAlternatively, just set the value you want on the calico-node daemonset?
d
dry-wolf-5380
10/30/2023, 2:18 PMThanks Lance, but setting it in the daemonset doesn't work either, because the tigera operator overwrites the changes
dry-wolf-5380
10/30/2023, 2:19 PMWhat I'm actually trying to do is set
FELIX_FEATUREDETECTOVERRIDE="ChecksumOffloadBroken=true,SNATFullyRandom=false,MASQFullyRandom=false"g
great-jewelry-76121
10/30/2023, 2:20 PMDefinitely ask this in the calico slack - if its a bug that you can't set it in an operator installed system, hopefully someone will see it and fix it.
d
dry-wolf-5380
10/30/2023, 2:21 PMDefault value is
FELIX_FEATUREDETECTOVERRIDE="ChecksumOffloadBroken=trueg
great-jewelry-76121
10/30/2023, 2:23 PMshouldn't this come up in the calico-node either way?Depends what you mean by this. Where are you setting it, and what do you expect to see happen? If you mean "you set this in felixconfig and it should appear in the calico-node env vars", then I disagree.
d
dry-wolf-5380
10/30/2023, 2:23 PMOr another question: where do the env vars come from? How/where are they set?
dry-wolf-5380
10/30/2023, 2:24 PMWhen I open the FelixConfiguration in a new rancher/rke2 installation, then the FelixConfiguration has this setting by default
g
great-jewelry-76121
10/30/2023, 2:24 PMEnv vars are set by tigera-operator. They're a pretty blunt instrument, because you can't override env vars (as you've discovered)
Felixconfig is read directly by Felix in the calico-node pods. It'll output a log at startup to say what config its discovered, and as I said, there's a precedence ordering - env vars win, then per-node felixconfig settings, then global felixconfig settings, then defaults.
d
dry-wolf-5380
10/30/2023, 2:24 PMAnd I would expect it to show up in the calico-node config parameters (spec)
dry-wolf-5380
10/30/2023, 2:26 PMIf env vars exist, the felixconfiguration isn't taken into account at all?
g
great-jewelry-76121
10/30/2023, 2:26 PMCorrect.
d
dry-wolf-5380
10/30/2023, 2:26 PMOr param by param?
g
great-jewelry-76121
10/30/2023, 2:26 PMparam by param
d
dry-wolf-5380
10/30/2023, 2:28 PMAlright, thanks for the clarification. I'll try some more debugging
👍 1
g
great-jewelry-76121
10/30/2023, 2:29 PMFor Felix, you want to be checking the info log emitted at startup that lists the discovered config.
Note that updating felixconfig causes felix to restart.
d
dry-wolf-5380
10/30/2023, 2:30 PMGot it, thanks
dry-wolf-5380
10/31/2023, 8:08 AMHey Lance, I got it to work (took me some time to figure out that the config updates in-place without a pod restart (which I expected to happen)). If anyone else finds this thread - set
featureDetectOverride: ChecksumOffloadBroken=true,SNATFullyRandom=false,MASQFullyRandom=falsedry-wolf-5380
10/31/2023, 9:55 AMHm, strange behavior though. For some pods it works, for some it doesn't. Also for the ones that are able to establish a direct connection, it doesn't work all the time. So if I ping a pod and it is able to build a direct connection, and then I ping it again 10mins later, it stopped working. But then again a little later, it works again
g
great-jewelry-76121
10/31/2023, 10:01 AMThat's weird. There must be a reason. Can you use tcpdump to determine where the packets are going missing? That would narrow down the things to look at, at least
great-jewelry-76121
10/31/2023, 10:02 AMGoing to recommend the Calico slack again for this - https://slack.projectcalico.org/
While I'm OK with Calico configuration, for weird dataplane issues you're going to want the folks there, I think.
d
dry-wolf-5380
10/31/2023, 10:27 AMYeah, totally makes sense to switch to the calico slack, thx 🙂 👍
dry-wolf-5380
10/31/2023, 4:20 PMfyi: the issue was actually a traffic-loadbalancing configuration in the router and enabled p2p traffic in the UDM. It is now working with all pods/nodes. Thanks again for your help, Lance
g
great-jewelry-76121
10/31/2023, 7:51 PMWow! Good sleuthing, and thanks for the feedback